Cisco's second exploited email gateway flaw in 30 days: its two fixed builds were named on 14 September

Thirty days, two named builds, and no start date

Thirty days separate Cisco's last two advisories for exploited Secure Email Gateway flaws (derived from two dates, Monday 14 September and Wednesday 14 October 2026, both published at 16:00 GMT). The first, for CVE-2026-76461, is a SQL injection. The second, for CVE-2026-76519, is a relative path traversal in how the gateway handles email attachments when its file reputation service is on. Cisco scores both 9.8 and says in both that its Product Security Incident Response Team (PSIRT) became aware of active exploitation. The AsyncOS builds the October advisory names as first fixed, 15.5.5-014 and 16.5.0-780, are the same two builds the September advisories named.

That is the checkable part. What it does not establish is longer. Cisco says its PSIRT became aware of the attacks "In October 2026", a month and no day. It gives no count of appliances, no actor, no objective and no account of what was taken. It does not say whether a fixed build existed before the first attack. The word "zero-day" that BleepingComputer uses for this flaw appears in none of the five Cisco advisories read for this briefing. Cisco does not say whether the file reputation setting is on by default, or whether the fixed content scanner package reaches every deployment type without anyone acting.

This briefing reads Cisco's advisory page and its machine-readable copy, the CVE.org and NVD records, CISA's Known Exploited Vulnerabilities (KEV) file, the data behind the Shadowserver dashboard that BleepingComputer links, Cisco's release notes and user guide, the three earlier Cisco advisories the story leans on, and NCSC, ICO and Cyber Essentials pages. All were read between 19:05 and 19:33 BST on Wednesday 14 October 2026. BleepingComputer's report was read for its links and Cisco's earlier history, not for findings. Its page data stamps it 13:29 US Eastern time, which is 17:29 UTC, 18:29 BST, 89 minutes after Cisco's advisory (derived). Cisco sells the gateway, the cloud service built on it and the support contract, so its advisory is a vendor describing its own product; every statement about the flaw below is Cisco's unless another source is named.

What the advisory states, and what it does not

The table sets what Cisco's advisory of 14 October states against what it does not. It was at version 1.0, "Initial public release", when read. "Not stated" means not found in the advisory or the Cisco pages it links, read in full. It does not mean Cisco does not know.

Cisco advisory cisco-sa-esa-afw-zqYJkjxp, first published 14 October 2026 16:00 GMT, and the Cisco pages it links. Quotations are Cisco's.

The question	Stated by Cisco	Not stated
What is the flaw?	A relative path traversal (CWE-23) in the Advanced Malware Protection (AMP) feature, "due to improper handling of email attachments when the file reputation service is enabled". Unauthenticated, remote, CVSS 3.1 base 9.8 on Cisco's own vector. A crafted attachment sent through an affected device can write arbitrary files and run commands as root.	How many bugs sit behind the one CVE ID, which step in attachment handling fails, and whether it shares a cause with the 2024 file write flaw described below.
Is it exploited?	"In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability."	The first day of attacks, how many appliances, which customers, who is behind them, what they wanted, what was taken.
Who is affected?	Physical and virtual Secure Email Gateway where File Reputation "is enabled and assigned to a mail policy" and Content Scanner Tools is earlier than 25.3.0.5525. Secure Email and Web Manager and Secure Web Appliance are confirmed not vulnerable.	Whether File Reputation is on by default. Cisco's user guide describes setup that starts with feature keys and an explicit enabling step, and states no factory default.
What is the fix?	AsyncOS 15.5.5-014 or 16.5.0-780. For the 16.0 train, "Migrate to a fixed release." Also a Content Scanner Tools package, 25.3.0.5525 or later, applied without a software upgrade or restart, automatically or by an administrator command.	When the package was released, which AsyncOS builds ship it, whether a local update server carries it, and any row for the 13.0, 13.5, 14.0, 14.2, 14.3 or 15.0 trains.
Is there a workaround?	None. Cisco lists general hardening steps.	Whether turning File Reputation off or unassigning it is safe or enough. The two conditions imply it would take a gateway outside the description, but Cisco offers no such workaround.
How do I know if I was hit?	Search the system log for three possible "System Security" outcomes: suspected compromise, scan did not complete, no compromise indicator found. Check every cluster member. Cross-check firewall and network logs outside the device, because root access lets attackers "remove or hide evidence".	What writes those lines, when it runs, whether a device under an attacker's control could write the all-clear, and what an empty result means.
What about the cloud service?	Cisco has "directly contacted" Secure Email Cloud customers "where indicators of possible compromise were identified" (the indicators section says "on which malicious activity was detected"), has "deployed mitigations that are within Cisco's management", and has deployed a fixed Content Scanner Tools. For Cloud Gateway customers "no action is required".	How many customers, on what date, what the mitigations are, and whether the contact concerns this flaw or the 14 September one: the cloud paragraph is word for word the same in both advisories.
How was it found?	"During internal security scanning."	When, with what, and whether before or after Cisco knew of attacks. Cisco's 14 September hardening advisory says its bugs were found with "existing testing processes as well as frontier AI models"; this advisory does not say that.

Outside Cisco's page, the CVE record was published at 16:07 GMT, 7 minutes after the advisory (derived), with Cisco as the CVE Numbering Authority and the same 9.8. NVD's entry, published at 17:19 UTC, had the status "Received", which means no NVD analysis yet, and carries Cisco's score as its primary. CISA's KEV file, whose own release stamp is 19:10 UTC on 13 October and which was read at 19:10 BST on 14 October, held 1,741 entries and did not list CVE-2026-76519. CISA's implementation guidance says it aims to update the catalogue within 24 hours, with several reasons additions can be delayed. It listed the September flaw on the day of that advisory, with a 3 day due date and a forensic triage flag (derived: 14 to 17 September). The absence of a listing can change within hours and is time-stamped here.

One more date, which should not be over-read. The CVE ID was reserved on 19 August 2026, 56 days before the advisory (derived), within 7 milliseconds of the September SQL injection ID and four of the five IDs of the September hardening release. That dates a block of reserved IDs. It does not date the discovery of the bug.

Two conditions, and a fix that is not an upgrade

Cisco makes exposure depend on two things at once. The File Reputation service, which Cisco says is part of AMP, must be enabled and assigned to a mail policy, and the Content Scanner Tools version must be earlier than 25.3.0.5525. An administrator checks the first in the web interface, on the Advanced Malware Protection page of the incoming or outgoing mail policies, by looking at whether the Enable File Reputation box is ticked for a policy. The second is read with a status command at the command line. Cisco prints an example of a vulnerable version, 25.2.0.5427 followed by further digits, with its Last Updated column reading "Never updated". The fourth field of that example is 98 below the fixed version's (derived: 5525 minus 5427).

contentscannerstatus
contentscannerupdate

The fix has two routes. One is an AsyncOS build. The other is the package: Cisco says the fix "is also distributed to all licensed and supported" AsyncOS releases through the updated Content Scanner Tools, that updating "does not require a software upgrade or a product restart", that customers "who have enabled automatic Content Scanner Tools updates are not required to take any action once the update has been applied", and that those "who have disabled automatic updates should apply the Content Scanner Tools update manually". For Secure Email Cloud Gateway customers "no action is required". Three things stay open. First, "once the update has been applied" does not say when Cisco's servers began offering the package. Second, Cisco's AsyncOS 16.5 user guide says the default is for each gateway to download updates directly from Cisco's update servers, with a local update server as an alternative, and the advisory does not say whether a local server carries this package. Third, the advisory speaks of customers who have "enabled" or "disabled" automatic updates and is silent on the default for Content Scanner Tools.

This is not the first time this component has carried a fix. Cisco's advisory of 17 July 2024 for CVE-2024-20401 also described an arbitrary file write caused by "improper handling of email attachments" sent through the gateway, with the fix "distributed through an updated version of the Content Scanner Tools package" (23.3.0.4823 and later) and the same "Never updated" example output. It was published 819 days before this advisory (derived), and said Cisco was "not aware of any public announcements or malicious use". It also said the updated package was included by default in AsyncOS 15.5.1-055 and later; the 2026 advisory makes no such statement. Whether the two flaws share a cause is not stated, and this briefing does not say they do.

Cisco's fixed-release tables of 14 September (SQL injection advisory) and 14 October 2026 (this flaw). Affected builds per train are counted from the 23 builds Cisco lists in its CSAF file and CVE record (derived).

AsyncOS train	Affected builds Cisco lists (derived)	First fixed, 14 September SQL injection advisory	First fixed, 14 October advisory
13.0	2	15.5.5-014 (row "15.5 and earlier")	No row. Move to 16.5.0-780.
13.5	2	15.5.5-014 (same row)	No row. Move to 16.5.0-780.
14.0	1	15.5.5-014 (same row)	No row. Move to 16.5.0-780.
14.2	2	15.5.5-014 (same row)	No row. Move to 16.5.0-780.
14.3	1	15.5.5-014 (same row)	No row. Move to 16.5.0-780.
15.0	4	15.5.5-014 (same row)	No row. Move to 16.5.0-780.
15.5	5	15.5.5-014	15.5.5-014
16.0	6	16.0.4-302	"Migrate to a fixed release."
16.5	0 listed	16.5.0-780	16.5.0-780

Of the 23 builds, 5 (21.7 per cent, derived) are in the 15.5 train, which has a named fixed build. 6 (26.1 per cent) are in the 16.0 train, for which the October table names none. 12 (52.2 per cent) are in six trains with no row at all, so for them the only instruction is the sentence telling anyone on a release earlier than 16.5 to move to 16.5.0-780. Cisco's CSAF file marks its affected list "Complete", yet its release-notes index lists notes for builds such as 14.2.3, 14.0.3 and 15.0.4 that are on neither the affected list nor the fixed table, and the advisory does not say whether they are unaffected or omitted. Because the Content Scanner Tools version, not the AsyncOS build, decides exposure, the list is a guide and not a test.

The 16.0 row matters most to anyone who followed the 14 September tables to the letter. The SQL injection advisory named 16.0.4-302 as the first fixed 16.0 build. An appliance upgraded to it that day is not covered by October's table, which says only "Migrate to a fixed release." for 16.0, and Cisco's affected list stops at 16.0.4-016 without mentioning 16.0.4-302 either way. The September hardening release gives the same "Migrate" instruction for 16.0. Both advisories also carry a sentence recommending that anyone on a release earlier than 16.5 migrate to 16.5.0-780, so a customer who followed that sentence is covered and one who followed the 16.0 row is not. "Patched" on 14 September and "patched" on 14 October are therefore different states in that train. The content scanner package is the other route, and the one Cisco says needs no restart.

One data conflict is left unresolved. CVE.org's record for CVE-2026-76440, the path traversal umbrella ID of the 14 September hardening release, was last updated on 15 September and still says Cisco is "not aware of any public announcements or malicious use" of the vulnerabilities in that advisory. The advisory page, revised on 14 October as version 1.1 ("Added link to a related advisory"), now carries a footnote saying one vulnerability in that class "is known to be actively exploited". The same CVE.org record also lists 15.5.5-014 among affected builds, although both advisories' tables name it as the first fixed build. This briefing follows the advisories' tables, and notes that a scanner fed from CVE records and a reader of the advisory page can give different answers about one appliance. Cisco's risk-based disclosure page explains the umbrella model: bugs that share a weakness class are grouped under one CVE ID scored at the worst bug in the class, with no bug count. This site covered that in its briefing on Cisco's October bundle.

The third exploited gateway advisory in 301 days

This is the third Secure Email Gateway advisory reporting exploitation that the pages read for this briefing show, across a span of 301 days (derived: 17 December 2025 to 14 October 2026). CISA's catalogue file lists no other Cisco email gateway entry since October 2025. The table sets the three side by side. The December advisory is read here from its text, which Cisco last revised on 15 January 2026.

Cisco advisories cisco-sa-sma-attack-N9bf4 (17 December 2025), cisco-sa-esa-inj-2bLVGmhX (14 September 2026) and cisco-sa-esa-afw-zqYJkjxp (14 October 2026), and CISA's KEV file as read on 14 October 2026.

Item	17 Dec 2025	14 Sep 2026	14 Oct 2026
Flaw	CVE-2025-20393, Spam Quarantine, CVSS 10.0	CVE-2026-76461, SQL injection in email parsing, 9.8	CVE-2026-76519, path traversal in AMP file reputation handling, 9.8
Vector Cisco describes	A crafted HTTP request	A crafted email	A crafted email attachment
What must be true	Spam Quarantine configured ("not enabled by default") and reachable from the internet	"Regardless of device configuration"	File Reputation enabled and assigned to a mail policy, and Content Scanner Tools earlier than 25.3.0.5525
When Cisco says it learned	"On December 10" (7 days before the advisory, derived)	"In September 2026"	"In October 2026"
Secure Email Cloud	"Not affected"	Upgraded to 16.5.0-780, customers contacted where indicators were found	Customers contacted, mitigations deployed, fixed scanner deployed
CISA catalogue	Listed 17 Dec, due 24 Dec (7 days)	Listed 14 Sep, due 17 Sep (3 days)	Not in the file read at 19:10 BST
Cisco's source line	Found resolving a support case	The same	"Internal security scanning"

Two things stand out. The first is dating. Cisco gave a day for December and a month for the last two. This site has noted the same habit in Cisco's dating of the SD-WAN Manager attacks only as September. The second is the cloud row. In December Cisco said its cloud devices were not affected. In September and October it says it contacted cloud customers, in the same words, so the record does not say whether any cloud customer was contacted about this flaw specifically. No actor is named for the October flaw. For December, Cisco's advisory points to a post by its own Talos team on a cluster it calls UAT-9686; nothing read links that cluster to the later flaws.

Cisco's own disclosure page says advisories are planned for the first and third Wednesday of each month at 16:00 UTC, with out-of-cycle advisories reserved for "exigent circumstances" such as active exploitation. 14 September was a Monday, and 14 October was the second Wednesday of the month, not the first (7 October) or the third (21 October) (derived), so both fall outside the stated cadence, consistent with that exception. The diagram puts the dates on an axis drawn to scale.

The checks, and what they cannot tell you

Cisco's advisory gives administrators five checks. The table says what each can tell you and what it cannot.

The checks in Cisco's advisory of 14 October 2026, with what each does and does not establish.

Check	Can tell you	Cannot tell you
Is File Reputation enabled and assigned? (web interface, per mail policy)	Whether the first condition holds, policy by policy.	Whether the gateway was exploited, which policy carries which mail, or what the default was.
Content Scanner Tools version (command line)	Whether the second condition holds: earlier than 25.3.0.5525.	Whether an attacker got in before the update. The update is not described as removing anything.
System log: three "System Security" outcomes	Cisco's own marker: a suspected compromise indicator, a scan that did not complete, or no indicator found.	What produces the lines, how often, or whether an attacker with root could write the all-clear. Cisco's table has no row for no line at all.
Logs held outside the appliance	Cisco asks for firewall and network logs to be checked for unexpected uploads from the appliance to external addresses and downloads from malicious ones.	A date to search from, or how long to keep logs. Cisco gives neither.
Every cluster member	Cisco says to review each device's logs. Private keys used between members "could be accessed on a compromised appliance".	Which members, if any, were reached. Cisco says to restore every member of a cluster that holds one compromised appliance.

Order matters. Cisco says that on a suspected virtual appliance forensics should be recorded "before continuing to any of the following steps", because "Upgrading a compromised instance will destroy forensic data and logs". Its restore steps are a new virtual machine on a fixed release, a configuration rebuilt "without importing any previous configuration files", and renewed credentials "and any cryptographic materials that are installed on the appliance". For a physical appliance Cisco points to its Technical Assistance Center and asks that remote access be enabled. Cisco's release notes for AsyncOS 15.5.5 and 16.5 add that an upgrade runs a pre-upgrade security cleanup scan which removes files matching known threat signatures and records the details in the upgrade logs. Whether that scan produces the "System Security" lines is not stated. That an upgrade can remove files before anyone has taken a copy is the reason to preserve evidence first (inference). The Content Scanner Tools update needs no restart, and Cisco does not say whether that is a reason to prefer it while evidence is still being collected.

Two of the checks rest on the appliance telling the truth about itself. Cisco says an attacker with root "may remove or hide evidence of exploitation and indicators of compromise", and its logging advice is that logs "should be sent to an external server, if possible". The NCSC makes the same point about network devices in the UK section below. Cisco's "General Recommendations For Hardening" list (separate mail and management interfaces, no internet access to the appliance where avoidable, HTTP off, a firewall in front, strong authentication, external logging) is identical in the September and October advisories, checked by comparing the texts. It is sound practice. For a flaw delivered by an attachment sent through the gateway's own mail path, none of it blocks the vector, and Cisco states that no workaround exists.

Exposed online: what Shadowserver's 289 can and cannot say

BleepingComputer reports that Shadowserver "tracks nearly 300 Cisco Secure Email Gateway instances exposed online", with no information on honeypots or devices already secured. The dashboard's own data, read on 14 October, gives the series behind that sentence.

Shadowserver dashboard, IoT device statistics, vendor Cisco, model "Cisco Secure Email Gateway", 90 days to 2026-10-13, read on 14 October 2026. Figures marked derived are computed from the series.

Measure	Reading	What it does not say
Instances on 13 October (latest day)	289: Asia 124, North America 81, Europe 76, Africa 6, South America 2, Oceania 0 (sum of the six regions, derived).	AsyncOS build, whether File Reputation is on, Content Scanner Tools version, whether patched. Patch state is known for 0 of 289, so the share of the exposed count that anything can be said about is 0 per cent (derived).
Range over 90 days	From 238 (30 September) to 518 (20 July). 404 on 14 September and 289 on 13 October: down 28.5 per cent (derived).	Why. A fall is not evidence of patching: the dashboard gives no information on honeypots or devices already secured, as BleepingComputer notes.
A second label	"Secure Email Gateway", without the vendor prefix: 104 on 13 October, 36 per cent of the first label's count (derived).	Whether the two overlap. A reader filtering on one label sees a different "exposed" figure from a reader filtering on the other.
United Kingdom	0 on 13 October. At least one on 23 of the 90 days, never above 4, last non-zero on 18 September (derived).	How many UK organisations run the product. The series measures what Shadowserver can identify from outside, not the UK installed base, which no source read gives.
Method	Shadowserver's Device Identification report: devices "identified in our daily Internet scans", classified by vendor, model and type from scan signatures, with a version field "if any".	Whether this series uses the version field, or which service is fingerprinted. The attack Cisco describes is an email passing through the gateway, which is the path inbound mail takes by design (inference), so a gateway Shadowserver cannot fingerprint is not thereby unreachable.

So the exposed count is a floor on visibility, not a count of the vulnerable. To be vulnerable by Cisco's description a gateway needs two conditions that no internet scan can read, and the record gives no figure for how many deployments meet either.

Seven friendly names, and whose interest they serve

A label is not a control. Seven appear in this story.

Labels in the story, where each appears and what the record shows.

The label	Where it appears	What the record shows
"Advanced Malware Protection" and "File Reputation"	Cisco's advisory and product menus	Security features whose job is to examine attachments. The flaw sits in that examination, so the control is the attack surface. Cisco's user guide says the appliance will "attempt to extract the attachments" even from a message with malformed headers. An attacker needs only to get mail through the gateway.
"Automatic updates"	Cisco's advisory	A fix that arrives only if a setting is on and a channel is open. The advisory says "enabled" and "disabled" and gives no default, and its example of a vulnerable version reads "Never updated".
"Hardening release" and "umbrella" CVE ID	Cisco's 14 September advisory	Five CVE IDs grouped by weakness class, each scored at the worst bug in its class, with no bug count. One bug in the path traversal class is now said to be exploited, while that umbrella's CVE record, last updated 15 September, still says no malicious use is known.
"No compromise indicator was found"	The advisory's log table	A line written by the appliance being checked. Cisco says an attacker with root may remove or hide evidence.
"Customers were contacted" and "no action is required"	The advisory's cloud paragraphs	Contact means Cisco found indicators on a customer's appliance. "No action is required" is about the patch. Neither says the appliance is clean: Cisco says it is "engaged in remediation and recovery operations".
"Zero-day"	BleepingComputer's headline	Not Cisco's word. The same fixed builds were named on 14 September for other flaws, and the advisory says Cisco learned of attacks in October, so the label depends on the first day of attacks, which is not stated.
"Patched"	Everywhere	A state relative to an advisory. An appliance on 16.0.4-302 satisfied 14 September's 16.0 row and has no fixed AsyncOS build in October's table.

Cisco's interest, in one sentence: it sells the product, the cloud service and the support contract, and an advisory that says its gateways were hit and its cloud customers contacted is also an account of its own product's failure and its own remediation. Method is separate from accusation. Cisco published a fix, a check, a recovery procedure and a statement that it contacted customers, and its September hardening advisory says its own testing used frontier AI models to find multiple bugs at once. That openness is why the gaps above can be listed. They are gaps in what is stated, not evidence of concealment. This site has covered the same class of product before: FortiMail's exploited flaw, with no fixed build in any of four branches and Kiteworks' 125 advisories for an email gateway.

The UK: what the NCSC, Cyber Essentials and the ICO say, as read

The UK pages below were read on 14 October 2026. None names this flaw and none names an email gateway, so they are applied here by analogy, which is inference. The NCSC's edge device announcement of 4 February 2025 defines edge devices as internet-connected devices at the edge of a network and gives routers, smart appliances, IoT devices, sensors and cameras as examples. An email gateway sits at the edge for mail, but the NCSC page does not name it.

The sources, in the order of the table: the NCSC's alert of 27 August 2026; its guidance on responding to active exploitation of vulnerabilities; its blog on forensic observability and the 2025 guidance it points to; Cyber Essentials Requirements for IT Infrastructure v3.3; and the ICO's guide to personal data breaches.

UK guidance as read on 14 October 2026 from ncsc.gov.uk and ico.org.uk. Quotations are short and exact.

UK instrument	What it says, as read	Where it stops
NCSC alert, 27 August 2026, on internet-exposed systems and edge devices	For organisations without operational technology: keep an accurate inventory of internet-facing systems, understand the function and data flows of edge devices, apply "vendor security updates promptly", and monitor for "unexpected configuration changes or outbound connections". Register for the free Early Warning service.	Written about OT targeting. No product named, no deadline.
NCSC guidance on responding to active exploitation of vulnerabilities, published 1 May 2026, version 2.1	Have a rapid response pathway: "every hour that passes without the update being applied increases the chance of a compromise". For a flaw on the KEV list that is internet accessible, can give total control and can be automated, install within 24 hours plus an investigation by an assured incident response provider; 48 hours if it cannot be automated. Where a full investigation is not possible, the system "should be erased/destroyed and rebuilt as new". Suppliers should be contractually liable to mitigate quickly.	Applies once a flaw is on the KEV list, which this one was not when read. Neither Cisco nor CISA, in the pages read, says whether exploitation of this flaw is automatable, so the row that applies is not settled.
NCSC blog on forensic observability for network devices, 29 July 2026, and its 2025 guidance on forensics and protective monitoring	Defenders should be able to investigate "using trustworthy information provided by the system in a way that makes it difficult for attackers to tamper with it". The guidance recommends remote logging and logging attempts to clear or manipulate logs. For buyers whose devices lack the feature: "push for it".	Addressed to makers and buyers of network devices. Not binding.
Cyber Essentials, Requirements for IT Infrastructure v3.3, April 2026, Security Update Management	Software in scope must be "updated, including vulnerability fixes, within 14 days of release" where the vendor calls the fix critical or high risk or the CVSS v3 score is 7 or above, and have "automatic updates enabled where possible". The applies-to list names servers, desktop computers, laptops, tablets, mobile phones, firewalls, routers and cloud services.	Does not name email gateways, and what is in a certificate's scope is the applicant's choice. "Release" is undefined for a scanner package whose release date Cisco does not state: 28 October if counted from the advisory, 28 September if counted from the 14 September builds, which is 16 days past (derived).
ICO guide to personal data breaches	Report a notifiable breach "without undue delay" and within 72 hours of becoming aware of it, where feasible. Information may follow in phases. Keep a record of every breach. A processor must tell the controller "without undue delay".	Does not say a gateway compromise is a breach. Mail passing through the gateway can hold personal data, and a suspected compromise line starts the question of whether it was accessed. No source read answers it.

A gateway is the first line for mail, so everything behind it assumes it is clean: mailboxes, the directory it queries, and the certificates and signing material it holds. Cisco's list of what to renew, "credentials and any cryptographic materials that are installed on the appliance", is open-ended, and only your own configuration can say what exists on your gateway. Such appliances typically hold administrator and directory-lookup credentials, TLS keys and, where used, mail-signing keys (inference from how they are normally configured, not from the advisory). The NCSC's point on forensic observability bears on the checks above: a check that the device runs on itself is the opposite of information that is "difficult for attackers to tamper with".

What to do, in the order worth doing

Every item below is a step Cisco, the NCSC or the ICO already names. The order puts reading and preserving before changing, because Cisco itself warns that an upgrade destroys forensic data.

What could not be verified

• When the attacks began, how many appliances, who, what was taken. Not stated by Cisco or in any source read.
• The release date of Content Scanner Tools 25.3.0.5525 and which AsyncOS builds ship it. Cisco's public release-notes index lists AsyncOS notes and a File Reputation update note last revised on 28 June 2023; no note for the scanner package was found. The fixed-issue list for 16.5.0-780 sits behind Cisco's Bug Search Tool login, which was not used.
• Whether File Reputation is on by default, and whether automatic updates are on by default for Content Scanner Tools. Not stated.
• Whether the cloud contacts concern this flaw, the earlier one, or both. The cloud paragraph is identical in both advisories.
• Release dates of 16.5.0-780. The 16.5 release notes PDF says "Published: October 07, 2026" while Cisco's index lists the same file as 15 September 2026; the 15.5.5 notes are dated 8 September 2026. Neither date was reconciled.
• The CVE.org conflict over 15.5.5-014 and over the umbrella record's exploitation wording, described above, was left as found.
• What Shadowserver fingerprints, and how the two Cisco labels overlap. Not stated on the dashboard or the report page.
• Not read. Cisco's Bug Search Tool, any Talos post on the October flaw (a search found none), CISA's Known Exploited Vulnerabilities enrichment fields for this CVE, and BleepingComputer's own sources.
• Time-stamped. Sources were read between 19:05 and 19:33 BST on 14 October 2026. A catalogue listing, an advisory revision or a CVE record could change within hours.

The question that exposes the gap

If Cisco confirmed tomorrow that the first attack on your gateway came before 14 September, which log, held somewhere an attacker with root on the gateway could not reach, would you use to find out?

Key facts